[Autogenerated] I'm gonna ask you the pro,
because this is actually the worst section for tough questions for the QS.
IT is right, Because the last one I'm gonna ask you is Jacob.
What's a significant change?
Because you have to scam quarterly or significant change.
So So that varies based on the organization, right?
And and again, you know, in the USA says it depends.
Asked the U.
S A.
On what does it depend?
Right?
And look for the quality of that answer.
Right?
So an organization that deploys all of their systems by hand,
right and does so infrequently, uh, you know,
or or has a very sort of manual build process,
right?
If they put a new server in the environment,
maybe that's a significant change for them,
right?
An organization that lives in some sort of cloud based service where it
could sort of automatically deploy systems and then and then decommissioned
them based on volume based on load or activity.
Right?
Deploying 100 new systems might not be a significant change,
all right, but But I would say if it effects so the security profile right?
Or the threat profile or the attack surface um,
or you you can see the where it's affecting.
Maybe what you would have said about one of the PC AD DS s requirements,
right then.
That's absolutely a significant change, right?
Uh, and then, you know,
other cases where that maybe doesn't fit that qualification.
It's a sort of situational, right?
It's intended to be something that you again you have some sort
of good faith effort to try to determine your criteria for that
internal scanning cloud environments.
Is that tough?
It can be right.
The notion of an internal network sometimes starts to fall apart, right?
So the goal the goal was internal scans was to say,
What can we see from an internal vantage that we can't
see from an external vantage right on?
And how do we avoid the situation where maybe the perimeter
has all of the sort of security hardening?
But once you get past that, uh, it's it's very,
you know, soft and squishy, right?
It's loose and easy to sort of affect things.
That versus chocolate.
Eminem Exactly on the outside, Soft on the inside.
Exactly.
Right.
So the goal of the internal scan was to say,
Let's look at the interior of the environment.
Right?
Uh, you know, inside the perimeter, right?
Because, you know,
we've been talking about this idea of d perimeter ization for a long,
long time.
Um and and see what we see right and and, you know, resolve those concerns.
So if if there's not really an interior sort of vantage,
right,
if what you see from from an external perspective is what
you see from an internal perspective, right?
And that external, that internal aspect converge, uh, in a cloud environment.
Yeah.
Okay.
But if you have a VPC with, like,
internet facing stuff and non internet facing stuff,
you're scanning the non internet facing.
Exactly.
Yeah, that's exactly right.
Great.
Can we go back to the full passing scans?
Sure.
If a merchant's missed, of course.
What do they need to do?
So if they've missed a quarter sometime ago,
right and absent a time machine, you can't go resolve that.
Uh, I mean,
I would want to see historically what I would have wanted to see was
obviously a current passing scans and then some sort of additional
measure to make sure that this didn't happen again.
Right?
Uh, some of the stuff in, like, 10.8 and 12.11, which we'll talk about later.
Uh,
sort of already now require those additional controls
to make sure things don't fall down.
So that's a less sort of clear cut approach to maybe like a
compensating control from missing the scans.
You can You could always you could always just sort of kind of,
you know, how to Just how do we prevent this from happening again?
And if they're a week?
Lights, I mean, how excited that you are.
So So there have been some some guidance statements from
the council that they really do want, you know,
90 days.
I really do want quarterly.
Um, you know, I guess up up until that point,
I have been sort of less concerned about a little bit here a little bit there.
Um, you know, particularly if it's just Hey, the scan is still running, right?
But we got a lot of hosts and it takes time.
You know, I I guess I didn't I didn't get too bent out of shape about that.
Um, but the I mean, the guidance is, you know?
Yeah, you got to kind of stick the landing on the timing on.
So, you know,
to the extent that you could sort of hold somebody
to that I think you want to do.